I read this as an implementation task - I’ll inspect the sealed v4 evidence and adjacent controller conventions, then create and independently verify an append-only v5 without touching product or immutable evidence.


Exploration confirms v4’s gap: clean poststate only checks `HERMES_HOME` in `/proc/*/environ`, while an unrelated long-running journal follower exists and must remain allowed. I’m implementing a target-scoped, race-aware same-UID `/proc` inventory plus inactive systemd control-state proof, with execute removed from the v5 CLI surface.


The v5 scanner and 21 deterministic tests are in place. I’m now exercising the real dry-run and verify surfaces against the sealed archive/current clean profile, then I’ll produce an independent verifier, immutable-predecessor checks, inventory, and final seal.


The real controller and independent verifier both pass on the current clean state: the target service is inactive/dead with MainPID and ControlPID zero, two `/proc` passes find zero target-owned processes, and the unrelated `mgc-tradingview-tab-keeper.service` journal follower remains correctly allowed. I’m performing the final sealed-package and predecessor-integrity checks now.


I read this as completed implementation - the append-only v5 controller is sealed and independently verified.

- Root: `.omo/evidence/task26/task26-post-lifecycle-cleanup-v5-4a6c7ee5-st_01a00ed7`
- Evidence root: `de12cbdf8ac7f2bf0ef92cf02fbd5b227e2b2e3862b90395cf1c3774e32dba61`
- Controller: `61c2188a3d4152b64663bc9505b384c795a150247aa098fa5dd56ed2616af691`
- Seal: `0d5477d8cd143da0b254329341fdee7a90ae998d89b9f265b7c01ed48d77ba7f`
- Inventory: `3aabb5cac37e4a3cbb01982ac8f5d4168371c6d61d6318c559d44f9cb83138a8`
- Tests: 22 passed; Ruff, compile, and LSP passed
- Independent verifier: `efa4be943ec53e6de503f1f2dbb75e02cd84536a137f3acdd5521b6794de6ea8`
- Independent receipt: `4d6c9ea21a40257befcb64f13bc76ccbfa4e0a1a685e7171d08d265a021ef1f0`
- Seal verifier: `defc4de8bc7bda1be43c15e9aa56034ab0fcf78ea58d20b446d46ae90d813c7d`

Exact finding closed:

> Clean-poststate verification only checks HERMES_HOME in /proc/*/environ and therefore does not prove that session-owned journal followers, inotify observers, profile processes without HERMES_HOME, observer event processes, or task-owned monitor commands have exited.

V5 now performs two race-aware same-UID `/proc` passes, captures PID/start-time/session/cmdline evidence, excludes its own invocation identities, allows unrelated services, and independently proves inactive/dead service state with MainPID/ControlPID zero.

No cleanup replay, service action, or live mutation occurred. V3, v4, archive, product, config, Git, and planning surfaces remain unchanged.